Authorization Bypass in Wicked Folders Plugin for WordPress

CVE-2023-0716

Summary

The Wicked Folders plugin for WordPress allows authenticated users with subscriber-level permissions and above to exploit an authorization bypass due to a missing capability check in the ajax_edit_folder function. This flaw, present in versions up to and including 2.18.16, enables these users to perform administrative actions, such as altering the folder structure that the plugin manages. Such unauthorized access could lead to significant disruptions within the site, affecting both the organization and its users.

References